CVE-2021-35947

CVE-2021-35947 affects the ownCloud server prior to 10.8.0. The flaw allows a remote attacker to reveal the internal path and the username of a public share by inserting invalid characters in the share URL. The issue is tied to the public share controller; exploitation details and a confirmed aff...

CVE-2021-35947

The public share controller in the ownCloud server before version 10.8.0 allows a remote attacker to see the internal path and the username of a public share by including invalid characters in the URL...

ownCloud < 10.8 Multiple Vulnerabilities

ownCloud is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud"; ifdescription...

Owncloud ownCloud 授权问题漏洞

Owncloud ownCloud is a personal cloud storage solution from the US-based ownCloud Owncloud. An authorization issue vulnerability exists in ownCloud Server, which stems from a session cookie not being reset after authenticating against a public link. An attacker could exploit this vulnerability to...

ownCloud 信息泄露漏洞

Owncloud ownCloud is a personal cloud storage solution from US-based ownCloud Owncloud. An information disclosure vulnerability exists in ownCloud Server that stems from a generated error message containing sensitive information. An attacker could trigger the error by appending certain characters...

Owncloud ownCloud 权限许可和访问控制问题漏洞

Owncloud ownCloud is a personal cloud storage solution from the US-based ownCloud Owncloud. The ownCloud Server suffers from a Privilege License and Access Control Issue vulnerability that stems from the ability of a federated share recipient to increase privileges, which can lead to bypassing...

ownCloud 安全漏洞

Owncloud ownCloud is a personal cloud storage solution from the American company ownCloud Owncloud. A security vulnerability exists in ownCloud Server that stems from the ability to bypass permission checks for file deletion by using the shareinfo API. The vulnerability can be exploited by an...

Shareinfo url doesn't verify file drop permissions - ownCloud

The permission check for a file drop upload only share could be circumvented by using the shareinfo API. This allowed to see from the files in the filedrop but didn’t allow downloads...

Session fixation on public links - ownCloud

The session cookies were not reset after authenticating for public links...

Federated share recipient can increase permissions - ownCloud

The receiver of a federated share could update the permissions granted to the receivers of the share...

files_antivirus 操作系统命令注入漏洞

filesantivirus is a ClamAV-based ownCloud antivirus application. filesantivirus before 1.0.0 suffers from an operating system command injection vulnerability that allows remote users to execute arbitrary shell commands on the target system...

files_antivirus 代码问题漏洞

filesantivirus is a ClamAV-based ownCloud antivirus application. A security vulnerability exists in filesantivirus, which allows remote attackers to exploit the vulnerability to compromise a target system. The affected products and versions are as follows:files antivirus:Prior to 1.0.0...

Arbitrary code execution through admin settings - ownCloud

In the administration settings of the filesantivirus app it was possible to execute arbitrary code...

Upload of malicious files to publicly shared folders - ownCloud

It was possible to upload malicious files to a public share. The malicious files were detected but ended up in a state where they were not deleted...

CVE-2021-29659

ownCloud 10.7 has an incorrect access control vulnerability, leading to remote information disclosure. Due to a bug in the related API endpoint, the attacker can enumerate all users in a single request by entering three whitespaces. Secondary, the retrieval of all users on a large instance could...

CVE-2021-29659

ownCloud 10.7 has an incorrect access control vulnerability, leading to remote information disclosure. Due to a bug in the related API endpoint, the attacker can enumerate all users in a single request by entering three whitespaces. Secondary, the retrieval of all users on a large instance could...

Improper access control

ownCloud 10.7 has an incorrect access control vulnerability, leading to remote information disclosure. Due to a bug in the related API endpoint, the attacker can enumerate all users in a single request by entering three whitespaces. Secondary, the retrieval of all users on a large instance could...

CVE-2021-29659

ownCloud 10.7 has an incorrect access control vulnerability, leading to remote information disclosure. Due to a bug in the related API endpoint, the attacker can enumerate all users in a single request by entering three whitespaces. Secondary, the retrieval of all users on a large instance could...

CVE-2021-29659

OwnCloud 10.7 is affected by an incorrect access control vulnerability in a related API endpoint that allows remote information disclosure. An attacker can enumerate all users in a single request by supplying three whitespace characters, and on large instances this may add unusual load. The conne...

CVE-2021-29659

ownCloud 10.7 has an incorrect access control vulnerability, leading to remote information disclosure. Due to a bug in the related API endpoint, the attacker can enumerate all users in a single request by entering three whitespaces. Secondary, the retrieval of all users on a large instance could...